---
id: CVE-2023-50447
aliases:
  - GHSA-3f63-hfp8-52jq
  - BIT-pillow-2023-50447
  - PYSEC-2026-457
title: Arbitrary Code Execution in Pillow
summary: Arbitrary Code Execution in Pillow
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: pillow
product: pillow
ecosystem: pip
affected:
  - pillow < 10.2.0
patched:
  - pillow 10.2.0
published: '2024-01-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:04.766695102Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3f63-hfp8-52jq'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-50447'
  - url: >-
      https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a
  - url: 'https://devhub.checkmarx.com/cve-details/CVE-2023-50447'
  - url: 'https://duartecsantos.github.io/2023-01-02-CVE-2023-50447'
  - url: 'https://duartecsantos.github.io/2024-01-02-CVE-2023-50447'
  - url: 'https://github.com/python-pillow/Pillow'
  - url: 'https://github.com/python-pillow/Pillow/releases'
  - url: 'https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html'
  - url: 'https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security'
  - url: 'http://www.openwall.com/lists/oss-security/2024/01/20/1'
tags:
  - osv
  - pip
epss: 0.01703
epssPercentile: 0.76256
ingestedAt: '2026-09-12T03:13:01.646Z'
---

## Overview

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

## Affected packages

- `pillow < 10.2.0`

## Remediation

Upgrade to a patched release:

- `pillow 10.2.0`